WEBVTT 00:00.700 --> 00:04.320 Thank you Ajit for the kind intro and I'm Victor Fang. 00:04.320 --> 00:10.980 I'm the CEO of Ancient AI and I'm joining from San Jose, where the company is located. 00:11.020 --> 00:17.220 And it's a great honor to be presenting as a keynote at the DEF CON Blockchain Village here. 00:17.220 --> 00:23.300 And today I'm going to talk about this most recent, very interesting hack, right, on Twitter. 00:23.380 --> 00:28.100 We call it the Twitter Tax Day Disaster. 00:28.100 --> 00:34.680 We're going to talk, explain to you the beginning and the end and all the implications to the industry. 00:37.970 --> 00:39.710 So first of all, who am I, right? 00:39.710 --> 00:44.370 Like Ajit just said, I presented last year, but some of you may be not new here. 00:44.370 --> 01:00.750 So I founded Ancient AI in 2018 and like some of the folks in the village, right, I also worked at FireEye Mendiant before and I was very honored to be recognized as the face of FireEye 2017 to now, actually. 01:00.750 --> 01:01.050 Yeah. 01:01.050 --> 01:05.170 And I say this year, they're still using my face to represent the FireEye. 01:05.170 --> 01:06.150 It's a great company. 01:06.150 --> 01:10.730 I really, I'm super pleased to see that. 01:10.730 --> 01:16.750 And I'm a big AI and machine learning practitioner since 2007. 01:16.750 --> 01:26.550 And one of my work is including how to use machine learning to detect the PowerShell exploit that is specifically in the APD32. 01:26.610 --> 01:29.490 And I actually have a blog on FireEye, check it out. 01:29.490 --> 01:42.570 And also I'm very honored to be able to work with the great engineers and all that and ship the products, the machine learning powered products to our network, endpoint, email in various companies. 01:42.730 --> 01:53.250 And also when I'm not solving the cybersecurity problems or blockchain problems, I also play electric guitar, but my teacher told me that I keep my day job yet. 01:53.250 --> 01:57.410 So I need your help to help me successful so I can create music. 01:57.410 --> 01:59.530 I can spend more time with music. 01:59.650 --> 02:00.950 So that's myself. 02:01.230 --> 02:03.410 And a little bit about my company, Ancient AI. 02:03.410 --> 02:07.370 We are an AI powered blockchain risk and compliance solution company. 02:07.370 --> 02:11.170 So the team are mostly from FireEye, Mendiant, McAfee. 02:11.690 --> 02:22.190 Then also my co-founder is coming from the internet industry, Yahoo, Pivotal, and we are backed by SIG, Cisco HANA, and Amino Capital. 02:22.190 --> 02:25.390 We are also part of the Berkeley Blockchain Accelerator. 02:25.910 --> 02:29.690 So yeah, so what's the largest hack in 2020, right? 02:29.690 --> 02:32.910 I may ask, when I ask different person, I'm going to get different answers. 02:32.910 --> 02:35.890 Some talk about this March hack on T-Mobile. 02:35.890 --> 02:39.070 Some talk about this Mario hack in April, right? 02:39.070 --> 02:40.410 Those are major hacks. 02:40.410 --> 02:46.790 But I think the biggest one, right, at least the one that gets to the mainstream is actually this text they had. 02:46.810 --> 02:48.930 It happened only a few weeks ago, right? 02:49.030 --> 02:50.970 July 15, 2020. 02:51.110 --> 02:56.270 And this is the screenshot of those celebrities, hacker, that being hacked. 02:56.430 --> 03:01.530 And this is something I'm going to talk about, drilling into every detail of it. 03:01.970 --> 03:05.250 And by the way, we have a contest in progress right now, right? 03:05.250 --> 03:07.230 Thanks for Ajit's help, right? 03:07.230 --> 03:08.770 So we're running it right now. 03:08.770 --> 03:10.030 We're actually in the middle of it. 03:10.030 --> 03:14.230 And actually some of the people already submitted the answers. 03:14.430 --> 03:15.230 Very cool. 03:15.230 --> 03:25.790 And yeah, and then I actually got the honor to be interviewed by the CBS News, right, on this specific incident, right? 03:25.790 --> 03:33.850 And yeah, very great to spend 10 minutes with Len Pease, one of my favorite news anchor. 03:34.730 --> 03:36.390 And okay, let's get down to it, right? 03:36.390 --> 03:43.430 So Twitter hack, it's actually the perfect crime, combining the centralized and decentralized. 03:43.430 --> 03:47.790 That's why I found it super intriguing. 03:48.370 --> 03:51.530 And if you step back and look at all this, right? 03:51.690 --> 03:56.210 We are actually at the boundary of two worlds, right? 03:56.630 --> 03:59.610 Centralized, those internet and banks and all that, right? 03:59.610 --> 04:06.990 And then decentralized, which is a lot of people here are big fans of blockchain, which is designed to be centralized. 04:06.990 --> 04:09.990 And the difference right now as of 2020, right? 04:11.150 --> 04:12.950 The centralized world, right? 04:12.950 --> 04:15.490 It's well studied, plenty of tools and all that, right? 04:15.490 --> 04:18.150 And then the decentralized world, right? 04:18.150 --> 04:21.410 In contrast, less study and lack of tools. 04:21.410 --> 04:23.850 So when the incident like that happened, right? 04:23.850 --> 04:28.670 People focus a lot on those internet, how they're hacking and all that, right? 04:28.670 --> 04:32.970 But fewer people actually focusing on what's happening on the blockchain. 04:32.970 --> 04:36.170 And that's actually the problem we're trying to solve also. 04:37.270 --> 04:39.510 And for this Twitter hack, right? 04:39.990 --> 04:44.410 We call it a Nigerian Prince scam 2.0, right? 04:44.410 --> 04:50.810 And yeah, so for those of you, I still remember those in the 1990s, those famous scam, right? 04:50.810 --> 04:52.630 You get emails or a letter, right? 04:52.630 --> 04:55.970 Saying, Hey, I'm Prince of Nigeria, right? 04:55.970 --> 04:58.350 And then I'm showing money. 04:58.530 --> 05:04.850 If you mail, send me a thousand dollars, I can send you $2,000 back in a few weeks, right? 05:04.850 --> 05:06.650 It's actually exactly what happened. 05:06.710 --> 05:08.390 The same tactic, right? 05:08.850 --> 05:11.430 And it's actually combining the cybersecurity hack, right? 05:11.430 --> 05:17.270 So they're social engineers and it's, which is a takeover into the Twitter main tool, right? 05:17.270 --> 05:19.410 It's a very typical insider spam, right? 05:19.410 --> 05:23.810 And as an outsider, the end user is literally very little you can do. 05:23.810 --> 05:24.390 Okay. 05:24.410 --> 05:26.610 And the second part is a financial scam. 05:26.690 --> 05:28.530 Once they get a hold of your account, right? 05:28.530 --> 05:33.390 They actually launched a Bitcoin as a scam using Bitcoin, right? 05:33.390 --> 05:35.970 It's actually this Nigerian Prince scam. 05:35.970 --> 05:39.530 It's a very famous scam called an advance fee scam, right? 05:39.530 --> 05:44.230 And then they leverage those money laundering as we're going to get into details. 05:44.830 --> 05:45.710 The timeline, right? 05:45.710 --> 05:47.030 Let's look at it, right? 05:47.030 --> 05:50.890 There's actually 10 plus Twitter accounts being hacked, right? 05:50.890 --> 05:52.730 In only three hours, right? 05:52.730 --> 05:56.350 And we summarize it in this nice timeline, right? 05:56.350 --> 05:58.250 There's actually three waves, right? 05:58.250 --> 06:02.170 The first wave are actually a blockchain industry, right? 06:02.310 --> 06:06.150 Finance, Coinbase, and all those celebrities, right? 06:06.150 --> 06:08.090 In this blockchain industry, right? 06:08.090 --> 06:11.590 And then the second wave starting from 1pm in the middle, right? 06:11.630 --> 06:14.770 Elon Musk, Bill Gates, and then Apple and Uber, right? 06:14.770 --> 06:15.310 Roughly. 06:15.310 --> 06:17.530 They are all in the high tech industry. 06:17.530 --> 06:20.250 Then the third wave, the politicians, right? 06:20.570 --> 06:24.670 Obama, Joe Biden, and King Wes and all that, right? 06:24.670 --> 06:28.170 And they are the third wave being hacked before the show is over. 06:28.170 --> 06:32.450 And it's funny to mention that Elon Musk got hacked twice in this wave also. 06:33.570 --> 06:34.910 If we look at it, right? 06:34.910 --> 06:36.430 It's getting more interesting, right? 06:36.430 --> 06:39.590 So the hacker posts the Bitcoin address in Twitter, right? 06:39.590 --> 06:41.430 And people start sending money to it, right? 06:41.430 --> 06:45.510 And then if you look at this chart, we generate it using our CISO tool, right? 06:45.870 --> 06:48.890 You can clearly see that within the 24 hours, right? 06:48.890 --> 06:50.970 There's a lot of money movement on the blockchain, right? 06:50.970 --> 06:52.110 This is what I say. 06:52.110 --> 06:57.410 This is the dark side of the decentralized world, right? 06:57.410 --> 07:01.170 Not a lot of people are aware of it because of the lack of tools, right? 07:01.450 --> 07:03.590 And then this is exactly what we're trying to help, right? 07:03.910 --> 07:11.750 Within 24 hours, actually, the hacker receives those money and starts doing the money laundering, right? 07:11.750 --> 07:15.230 And within 24 hours, they wire into six different wallets. 07:15.230 --> 07:19.190 We actually have a full detail blocks in our media, okay? 07:19.190 --> 07:30.670 And it's funny to mention that there's actually still... we're able to recognize three... there's three victims coming from a known exchanges, right? 07:30.670 --> 07:33.150 Are sending money to it, right? 07:34.790 --> 07:39.190 And then if we look at a longer time horizon, right? 07:39.190 --> 07:39.990 Five days. 07:39.990 --> 07:43.350 And then actually, as we predicted on day one, right? 07:43.350 --> 07:47.350 The hacker starts to run through the mixers, right? 07:47.350 --> 07:48.810 The tumblers, right? 07:49.010 --> 07:51.210 To start the money laundering process, right? 07:51.210 --> 07:54.310 Those are the hops and splits and jumps, as you can see, right? 07:54.310 --> 07:56.830 They actually eventually get into this wasabi mixer. 07:56.830 --> 07:58.790 I will spend more time on it later. 07:59.870 --> 08:01.390 And there's a quick update, right? 08:01.390 --> 08:02.890 I mean, a few days ago, right? 08:02.890 --> 08:04.630 You guys are probably already aware of it, right? 08:04.630 --> 08:06.890 So those three Twitter hackers are arrested. 08:06.890 --> 08:09.470 One of them, I think it's confirmed to be in Florida. 08:09.470 --> 08:11.630 Two of them are actually the UK cities and all that. 08:11.630 --> 08:13.990 There's a wire article on that, right? 08:15.230 --> 08:20.190 And yeah, let's... I mean, let's... this is like a typical Mendian exercise, right? 08:20.190 --> 08:22.210 Let's try to attribute this hacker, right? 08:22.210 --> 08:24.190 So we actually in day one, right? 08:24.190 --> 08:28.330 We launched this block, one of the most in-depth block, right? 08:28.530 --> 08:30.310 Investigation reporting industry. 08:30.450 --> 08:35.490 So the first one is like, we correlate with some of our threat intel, right? 08:35.490 --> 08:40.730 We find out this thing is actually correlated to crypto4health.com, right? 08:40.730 --> 08:46.990 And the right-hand side, yeah, this is the first time you guys are seeing it, but internally, we actually analyze more than just blockchain, right? 08:46.990 --> 08:51.870 We also analyze the domain registrations and all that in our threat intel database. 08:51.970 --> 08:56.090 So we knew that this was actually a US-based server, right? 08:56.090 --> 09:03.530 And then we also say, they will predict... they will start a Bitcoin mixer, money laundering, right? 09:03.530 --> 09:07.310 This is like how we found the ransomware, right? 09:07.310 --> 09:08.870 The WarnerCrypt and all that, right? 09:08.870 --> 09:09.930 Back in a few years ago. 09:10.130 --> 09:13.670 And then we also say, hey, it's a coordinate crypt, as you can see, right? 09:13.670 --> 09:16.790 That timeline is structured in three ways and all that. 09:16.790 --> 09:17.790 It's well-planned. 09:17.790 --> 09:20.330 It's not a random keep doing the random hacking, right? 09:20.330 --> 09:28.050 It's coordinate crypt, but it's less sophisticated than those hacking campaigns I have done with DeWitt before, right? 09:28.050 --> 09:29.630 At FireEye Mendiance and all that. 09:29.630 --> 09:33.610 Those APT hackers are more sophisticated than these guys. 09:34.070 --> 09:40.250 And then one thing we did miss, one prediction we did wrong is actually we told the media, hey, be patient. 09:40.250 --> 09:48.970 It may take a few months to arrest them, but actually the law enforcement were able to caught those guys in two weeks, right? 09:50.190 --> 09:54.070 And there's a question that I got asked often, right? 09:54.070 --> 09:57.910 So why the hackers only make $100,000, right? 09:57.910 --> 09:58.930 You think about it. 09:58.930 --> 10:01.670 Those most powerful people in the US, right? 10:01.670 --> 10:02.910 Their Twitter account got hacked. 10:02.910 --> 10:04.430 Why they only make 100K? 10:04.430 --> 10:06.270 Why the hacker only make 100K? 10:06.270 --> 10:07.110 That's nothing. 10:07.490 --> 10:10.430 But okay, if you remember that timeline, right? 10:10.430 --> 10:14.710 It's actually the shows only last for three hours, no more than that, right? 10:14.710 --> 10:22.990 And then if you divide it by three, that's actually still $36,000 per hour, pretty decent profit that they make, right? 10:22.990 --> 10:25.390 So I think thanks to the Twitter team, right? 10:25.390 --> 10:29.250 The compromised celebrities and everyone that alerted this hack, right? 10:29.250 --> 10:35.370 Including those people that forwarded our research report and some other companies report, right? 10:35.370 --> 10:44.350 This is actually the awareness where we can help bring more transparency, bring more light into this dark world. 10:44.910 --> 10:47.270 As my interview to Inverse, right? 10:47.270 --> 10:49.990 One of the New York based media, right? 10:49.990 --> 10:53.970 Humans are always the weakest link, as you can see again here, right? 10:53.970 --> 11:03.390 The threat vector is, again, is getting the human, getting the internal infrastructure and then compromise the entire Twitter admin tool, right? 11:03.390 --> 11:13.090 And this is exactly why our company, so we can act faster and be more preventive. 11:14.130 --> 11:15.030 Oh, okay. 11:15.030 --> 11:16.910 So let's get to the second section here, right? 11:16.910 --> 11:21.590 So I want to talk about some cool technology in the blockchain security and would like to pick this one. 11:21.590 --> 11:24.650 I think this is the most exciting technology advancement, right? 11:24.870 --> 11:27.930 SpaceX send us the Dragon Crew, right? 11:27.930 --> 11:32.130 They sent two astronauts to the ISS, super cool. 11:33.510 --> 11:37.530 And then look at the Earth, right? 11:37.530 --> 11:41.890 From the space, actually, you cannot see any border, okay? 11:42.230 --> 11:48.170 And actually, the human, right, create maps so we can navigate. 11:48.430 --> 11:51.930 This is exactly what nChain AI try to achieve, right? 11:51.930 --> 11:58.910 We create blockchain maps for this massive centralized world, so your business can navigate. 11:58.910 --> 12:12.710 For example, we are trying to identify which one are the exchanges, which one is the OTC and miner and hackers and all that, so we can make transaction more safely, more securely in this decentralized world. 12:13.590 --> 12:17.050 Then look at this world, right? 12:17.470 --> 12:18.970 That's $8 billion. 12:19.030 --> 12:24.670 Actually, only 1% of the money laundering are in cryptocurrency based on FATAP. 12:24.670 --> 12:31.970 FATAP is the organization defining the anti-money laundering standards and all that based in Europe, okay? 12:31.970 --> 12:34.070 So three typical, three steps, right? 12:34.070 --> 12:36.870 In any money laundering, including this one, okay? 12:36.870 --> 12:40.910 Including the Bitcoin and cryptocurrency and all Tether, stablecoins and all that. 12:40.910 --> 12:44.390 Three steps, placement, layering and integration, right? 12:44.390 --> 12:49.070 And we have done some investigation, including this Twitter hack one, right? 12:49.130 --> 12:56.790 And then actually, the hackers are actually, they use this technology, right? 12:56.790 --> 13:09.010 This money laundry in cryptocurrency technology being used by many, many other bad actors, like ransomware, people are selling their breach data on dark webs and all that. 13:10.270 --> 13:12.490 And this is a super challenging task, right? 13:12.490 --> 13:15.550 That's why we haven't seen any company have done that yet, right? 13:15.550 --> 13:23.550 One of the challenges is actually we have over 500 million addresses out there in the blockchain world and it's growing like crazy, right? 13:23.550 --> 13:25.870 And then if you make a comparison, right? 13:25.870 --> 13:27.230 This is where I live, right? 13:27.230 --> 13:29.870 In San Francisco Bay Area, a satellite map, right? 13:29.870 --> 13:34.570 Without putting those landmarks and all that, right? 13:34.570 --> 13:36.630 Like what usually you are seeing the map, right? 13:36.630 --> 13:38.850 Or putting the highways or buildings and all that. 13:38.850 --> 13:41.890 It's really hard to figure out what's going on there, right? 13:42.030 --> 13:43.530 And then the same thing, right? 13:43.530 --> 13:47.590 The Bitcoin UTXO transaction graph looks like the right hand side, right? 13:47.590 --> 13:50.590 And there's a 500 million vertices there. 13:50.590 --> 13:54.510 And it's going to get to billions real quick, right? 13:54.510 --> 13:56.990 Because we have many other blockchain coming up. 13:56.990 --> 14:04.130 Exelium is doing pretty well recently and there's other, like for example, those tokens are running on top of Exelium and all that, right? 14:04.130 --> 14:06.330 It's getting more and more challenging. 14:07.370 --> 14:09.030 And our solution to this, right? 14:09.030 --> 14:13.130 And I think this is a blockchain mapping is the best way to do it, right? 14:13.130 --> 14:19.250 There's three specific technology feature where a technology problem is solving, right? 14:19.250 --> 14:21.230 One is pseudonymity, right? 14:21.230 --> 14:24.030 We're using the threat intel UEBAs and all that. 14:24.030 --> 14:27.510 We try to figure out the behavior of the address. 14:27.970 --> 14:31.370 Then the second one we deal with is the massive data volume, right? 14:31.370 --> 14:34.510 We're left with big data cloud and GPU, right? 14:34.570 --> 14:36.970 Some of the models are running on deep learning. 14:37.070 --> 14:40.850 Then complex graph transaction relationship, right? 14:40.850 --> 14:47.230 That's where we actually develop AI and UX focused investigation tool that we will talk about. 14:47.230 --> 14:51.850 And actually some people in the room are already using that CISO product, right? 14:52.590 --> 14:56.390 Then our machine learning connect to more than 10 different blockchains, right? 14:56.390 --> 14:59.070 And as promised, I'm going to put one equation here. 14:59.070 --> 15:01.830 And this is the only equation in this entire slide, right? 15:01.830 --> 15:04.590 So one of the model is using deep learning, right? 15:04.590 --> 15:11.110 To try to figure out exactly the same technology being used by AlphaGo, AlphaStar, the self-driving car and all that. 15:11.110 --> 15:16.370 We're trying to figure out giving kinds of transactions of an address. 15:16.370 --> 15:20.130 Can we figure out the behavior of it, right? 15:20.130 --> 15:24.030 Then yeah, just to make an analogy here, right? 15:24.530 --> 15:27.190 500 million blockchain addresses, right? 15:27.190 --> 15:30.270 It's like what the map is our intelligence we're creating. 15:30.270 --> 15:31.470 The bank, right? 15:31.470 --> 15:33.470 That on the landmark, right? 15:33.470 --> 15:44.570 They are similar to reputable exchanges like Coinbase and all those top exchanges that are more focusing on compliance and regulation, right? 15:44.570 --> 15:46.210 And car accident, right? 15:46.210 --> 15:53.130 Those bad incidents and those are the suspicious actors that we reflect on the right-hand side here. 15:53.130 --> 15:55.250 And that's what the goal we're trying to achieve. 15:55.250 --> 16:00.990 We're trying to make it more transparent so we can navigate more securely and safely. 16:01.570 --> 16:04.330 Okay, let's do a little bit of a pop quiz, right? 16:04.370 --> 16:06.230 Yeah, who can tell me what is this? 16:06.230 --> 16:09.570 This is one of the typical Bitcoin address, right? 16:10.050 --> 16:10.950 What is it? 16:11.130 --> 16:14.310 It's hard to see, all those nonsense letters. 16:15.210 --> 16:22.630 Well, and then if you open and putting this address in any of the blockchain explorers and all that, right? 16:22.630 --> 16:24.070 This is what you're going to see, okay? 16:24.070 --> 16:27.470 It's a wealthy and probably still active Bitcoin wallet, right? 16:27.470 --> 16:30.030 That's usually this is what you can get, right? 16:30.470 --> 16:32.710 And it started at what? 16:33.110 --> 16:34.230 2017, right? 16:34.230 --> 16:35.770 If that's a hint to you. 16:36.250 --> 16:39.430 It turns out, okay, it's actually a WannaCry ransomware. 16:39.430 --> 16:44.910 One of the few wallets that they embedded into their ransomware, right? 16:44.910 --> 16:50.690 I think some of you probably are exploring in ransomware and all that. 16:50.690 --> 16:54.350 And this is actually one of the screenshot we get from the FireEye sandbox, right? 16:54.350 --> 16:59.270 This is that exact screenshot what pops up when you got infected by WannaCry. 16:59.670 --> 17:00.970 That little address, see that? 17:00.970 --> 17:06.850 That's the 12T9 is exactly what the hackers are using for receiving the ransom. 17:07.930 --> 17:14.090 Okay, so we have been building this intelligence database in the last two years, right? 17:14.090 --> 17:23.730 And then, yeah, so when you're plugging, we're trying to tell you, okay, this is actually the ransomware which even tells you the family, the WannaCry and all that. 17:23.730 --> 17:27.030 And most importantly, if you're running a crypto business, right? 17:27.030 --> 17:30.070 We will tell you, hey, do not transact with this guy, right? 17:30.070 --> 17:33.190 Reflect as the highest risk score, 100, right? 17:33.190 --> 17:33.990 Do not transact. 17:33.990 --> 17:39.730 If you make transaction with this guy, Boeing Forceman is going to come to you. 17:39.910 --> 17:43.730 And they are equipped with threat and intelligence tool these days. 17:44.690 --> 17:46.990 And actually, that's a good thing, right? 17:46.990 --> 17:52.950 So, and then, so that's exactly why we are launching this tool, right? 17:52.950 --> 17:54.150 For free, right? 17:54.150 --> 17:57.450 We're trying to democratize blockchain investigation. 17:57.470 --> 18:02.410 Other than paying $100,000 to buy some of the expensive commercial tool, right? 18:02.410 --> 18:06.090 We feel like we need to lower the barrier of entry. 18:06.090 --> 18:09.650 We need to make this tool more available to everybody, right? 18:09.650 --> 18:14.890 So, we can actually help this industry obtain X. 18:14.890 --> 18:16.810 So, by the way, as we're speaking, right? 18:16.810 --> 18:20.490 We actually just launched the second challenge in the same website, right? 18:20.490 --> 18:23.870 So, now you should see the button, right? 18:23.870 --> 18:25.290 Being activated. 18:25.590 --> 18:29.470 So, the second challenge is the WannaCry ransomware challenge. 18:31.170 --> 18:31.890 Okay. 18:31.890 --> 18:35.430 And so, let's drill down a little bit deeper, right? 18:35.430 --> 18:36.990 What is a Bitcoin mixer, right? 18:36.990 --> 18:41.950 Maybe, I mean, some of you are already using it or very familiar with it, right? 18:42.110 --> 18:44.450 Basically, as of now, right? 18:44.450 --> 18:52.650 It's the most popular Bitcoin mixer in the world, algorithm, right? 18:52.650 --> 18:56.550 There's a paper published a few years ago explaining the details of it, right? 18:56.770 --> 19:00.550 And then we believe that the Twitter hackers are actually using Wasabi, right? 19:00.550 --> 19:01.870 It's hard to tell, right? 19:01.870 --> 19:04.890 Because they keep shuffling around the wallets and address and all that. 19:04.890 --> 19:06.970 But then in the mixer, right? 19:06.970 --> 19:15.590 But then based on the machine learnings and all that, we can actually see the similarity of the transactions, right? 19:15.590 --> 19:20.790 They're using to the existing behavior training base we already have. 19:22.070 --> 19:22.850 Okay. 19:22.850 --> 19:24.290 So, as a human, right? 19:24.290 --> 19:27.310 If you're seeing transactions like this, right? 19:27.310 --> 19:31.030 It's very hard to figure out what that is, right? 19:31.410 --> 19:36.430 It's just one of the many UTXO transactions, right? 19:36.490 --> 19:38.890 You have some sudden behavior tracing there, right? 19:38.890 --> 19:40.490 That's why we can leverage machine learning. 19:40.490 --> 19:48.210 But it's still hard to say because some exchanges, especially the mainstream exchanges, will use similar technology like this also, right? 19:48.350 --> 19:53.210 And by the way, it is a Wasabi transaction, okay? 19:53.210 --> 20:01.290 We have detected over 700,000 of similar transactions like this, and that's only on the 2020, okay? 20:01.290 --> 20:04.370 And out of the 54 million total transactions. 20:05.970 --> 20:08.590 How machine learning detects this, right? 20:08.630 --> 20:14.730 So, this is one of... we're going to share with you some of the best models we built in our auto machine learning pipeline, right? 20:14.730 --> 20:17.270 This is the gradient boosting tree model we built, right? 20:17.270 --> 20:19.070 This is just an illustration of it. 20:19.070 --> 20:25.330 We have a thousand trees model, super accurate, that we trained from all this curated transaction data, right? 20:25.550 --> 20:31.590 And for example, on the left-hand side, that's one of the real... that's the Twitter hack transaction, right? 20:31.590 --> 20:45.230 And then some of them are actually... our model predicts as a high probability of being a because they have those certain characteristics of the Bitcoin mixer, right? 20:45.230 --> 20:47.670 And how machine learning can help, right? 20:48.390 --> 20:52.450 We have built thousands of those machine learning models, right? 20:52.450 --> 20:55.350 To specifically detect every behavior. 20:55.350 --> 20:57.550 For example, mixer is a big one. 20:57.550 --> 21:00.350 Exchange, hackers, and bots, right? 21:00.350 --> 21:02.570 We talked about bots last year, right? 21:02.570 --> 21:11.790 And then there's actually whatever you can find on the internet, the decentralized world, you can also find the equivalent party, the decentralized world. 21:11.790 --> 21:13.250 That's very interesting. 21:14.390 --> 21:16.210 Can we prevent this, right? 21:16.210 --> 21:20.270 I think it's totally feasible if we equip with the right technology, right? 21:20.270 --> 21:21.890 And like Coinbase, right? 21:21.930 --> 21:25.350 Coinbase did a great job, incident response, right? 21:25.350 --> 21:29.790 And then as Phil Martin presented to the Forbes, right? 21:29.790 --> 21:37.410 So I think, yeah, they were able to block them when this thing is just starting to happen, right? 21:37.550 --> 21:39.850 So thanks for doing that Coinbase, I think. 21:39.850 --> 21:43.150 And more exchanges should follow this pattern, right? 21:43.150 --> 21:51.790 Equip with the right technology, the right experts, block all these bad transactions, protect this entire blockchain ecosystem, 21:55.840 --> 21:56.680 right? 21:56.680 --> 21:59.220 Oh, I know some of the other companies, right? 21:59.220 --> 22:04.700 They kind of think about privacy in a different way, right? 22:04.700 --> 22:09.360 But our perspective, NCHI's perspective on the privacy on blockchain, right? 22:09.360 --> 22:13.340 Privacy should always be protected as well, okay? 22:13.340 --> 22:15.560 But there's a big distinction, right? 22:15.560 --> 22:21.520 Between this NCHI blockchain mapping versus other surveillance, right? 22:21.520 --> 22:25.820 We don't call our surveillance, we are mapping the blockchain world. 22:26.040 --> 22:31.180 We only get down to the behavior level, so that's like, what is it, right? 22:31.180 --> 22:37.120 So for example, I'm telling, okay, this address is a bank, it's a post office, that's it, right? 22:37.120 --> 22:40.100 Not to the individual level, that's a huge difference. 22:40.100 --> 22:54.640 We're not trying to breach the customer privacy, we're not trying to identify the individual level, and public intelligence, all of the intelligence are coming from public resources that we got, right? 22:54.820 --> 22:56.300 Then, don't be evil, right? 22:56.300 --> 22:59.700 Never monetize on the customer's privacy data, right? 22:59.700 --> 23:03.400 And focus on malicious addresses for the risk purpose, right? 23:03.400 --> 23:11.640 The whole business here, we're trying to make blockchain more secure to transact, that's on the privacy. 23:11.640 --> 23:22.120 And then, Twitter hack is actually defining a new chapter of the blockchain world in 2020. 23:22.120 --> 23:28.040 This is what I call the end of the beginning, I want to call Winston Churchill, one of my favorite characters, right? 23:28.340 --> 23:30.120 This is the end of the beginning. 23:30.620 --> 23:32.760 Why do I say that, right? 23:32.880 --> 23:35.340 We are entering a new chapter. 23:35.920 --> 23:37.180 Before this, right? 23:37.180 --> 23:41.520 I mean, Bitcoin shows up in 2009, right? 23:42.000 --> 23:44.320 And all the way until today. 23:44.320 --> 23:49.980 It's still a great area, especially in the regulatory compliance side, right? 23:49.980 --> 23:56.080 A different country, a different opinion on it, SEC still haven't figured out what really cryptocurrency is. 23:56.080 --> 24:00.180 Is it a security, a currency, or asset, or whatever, a commodity? 24:00.600 --> 24:02.280 They haven't figured it out yet, right? 24:02.280 --> 24:03.860 But going forward, right? 24:03.860 --> 24:16.240 2020 and beyond, they are already spending a lot of effort in defining this, to bring more regulatory compliance, providing guidelines on the VASP, right? 24:16.240 --> 24:18.540 The Virtual Asset Service Provider. 24:18.940 --> 24:26.580 For example, FADA, the AML, the company, at that organization, they're defining the standard for anti-money laundry, right? 24:26.580 --> 24:31.900 FADA and OCC, this is the bank regulator body in US. 24:31.900 --> 24:35.020 ISACA and SEC think about that. 24:38.300 --> 24:40.140 Is there a question? 24:43.180 --> 24:46.920 And then the community is going to help more transparency, right? 24:46.920 --> 24:50.220 And when I look at this, this industry, right? 24:50.320 --> 24:56.840 The moment it got acquired for blockchain adoption. 25:01.160 --> 25:02.760 Is there a question on the line? 25:06.360 --> 25:07.660 10x growth, right? 25:07.660 --> 25:11.360 Only happens when more blockchain adoption to the mainstream. 25:11.360 --> 25:22.340 And if we allow those hackers are using Bitcoin and cryptocurrency, the long-term funding and all that, this industry is going to fail, or it's going to stay like this, right? 25:22.340 --> 25:26.940 So that's why we need to... 25:28.020 --> 25:37.420 I mean, some of you actually doesn't look like working with the government bodies and all that, but I think this is actually helpful to make this industry grow 10x. 25:39.060 --> 25:40.260 And what's next, right? 25:40.260 --> 25:46.280 After this Twitter hack 2020, I think there's three things, three aspects to it. 25:46.940 --> 25:48.120 Awareness. 25:48.120 --> 25:54.620 Blockchain needs us to work as a community to fight all this illicit use of cryptos. 25:54.840 --> 25:56.900 The technology side. 25:57.380 --> 26:07.340 One of the main reasons that a lot of exchanges are still accepting those longer bitcoins or cryptocurrency stable coins and all that, right? 26:07.340 --> 26:10.860 It's actually because they lack of the technology, right? 26:11.220 --> 26:21.300 And then technology, as we are showing already, is making it possible to defend against those illicit use of cryptos, especially with machine learning and AI, right? 26:21.300 --> 26:30.860 So we have, like I said, we have almost 800,000 transactions using Wasabi, the mixer, in 2020. 26:31.080 --> 26:34.200 Some of them are good, some of them are bad, but at least we need to picture it. 26:34.200 --> 26:37.920 We need to kind of tell you, okay, it's actually a mixer. 26:37.920 --> 26:42.300 And then different countries, different exchanges have different policies against it, right? 26:42.300 --> 26:45.880 Compliance bodies also have different ways of defining it, right? 26:45.880 --> 26:55.700 For example, earlier this year, Binance, they got caught up by the Singapore MAS, right? 26:55.700 --> 26:59.300 The Singapore MAS is their regulatory body, like the SEC, right? 26:59.300 --> 26:59.940 Singapore. 26:59.940 --> 27:07.940 And then they kind of tell Binance, hey, you cannot accept mixer if they're coming into exchange, right? 27:07.940 --> 27:10.540 Things are still starting to change, right? 27:10.540 --> 27:18.400 So government has also realized that, okay, this cryptocurrency is going to be getting more and more mainstream, right? 27:18.400 --> 27:24.300 How do we make it secure for everybody, so more people can enjoy this great technology? 27:24.300 --> 27:31.460 And on the risk and security side, compliance side, technology is also a big factor to it, right? 27:31.460 --> 27:35.820 It can be applied to preventive or post-incident, right? 27:35.960 --> 27:40.160 Then the third one, regulatory compliance guideline from the public sector, right? 27:40.360 --> 27:45.060 FATF, OCC, SEC, and things like that, and 5AMLB, right? 27:45.060 --> 27:47.880 That's from the European side. 27:49.460 --> 27:57.460 Then, yeah, and then so I'm very fascinated by this SpaceX, right? 27:57.460 --> 27:59.120 That Dragon Crew, right? 27:59.120 --> 28:03.320 So and then we compared it to this Boeing Starliner on the left-hand side. 28:03.380 --> 28:09.980 I call it pre-2020, but then I decided to put another pre because this is a super vintage. 28:09.980 --> 28:15.680 If you look at the dashboard, man, this is crazy, and how it's going to navigate. 28:15.680 --> 28:18.480 There's like hundreds of buttons out there, right? 28:18.480 --> 28:21.820 If you look at our right-hand side, in contrast, right? 28:22.200 --> 28:26.940 Yeah, this is actually the design that SpaceX had, right? 28:26.940 --> 28:29.940 So make super sleek, super easy to navigate, right? 28:29.940 --> 28:34.100 It's spent a lot of time on the user experience, the UX side of it, right? 28:34.100 --> 28:36.340 To really make it accessible. 28:36.340 --> 28:39.300 And this is also, I feel, is important, right? 28:40.100 --> 28:48.560 If very few people can only use very few tools to get access, to understand what blockchain is, right? 28:48.560 --> 28:51.320 And that is a big problem for the industry, right? 28:51.320 --> 28:53.700 Think about it, like the internet, right? 28:53.700 --> 28:55.680 We're using internet every day, right? 28:56.360 --> 28:58.400 But on the blockchain side, look at it. 28:58.400 --> 28:59.600 How many tools do you use? 28:59.600 --> 29:04.680 If the blockchain explorer, yeah, those are only good, those are like Wireshark, right? 29:04.680 --> 29:10.240 But then you have to have something more accessible, more user-friendly for them. 29:10.240 --> 29:15.980 Even to look at those, this blockchain investigation side of it, right? 29:16.180 --> 29:20.340 It can actually help you understand more of what's happening. 29:20.340 --> 29:26.540 And I think that the general public, right, need to have a tool like that. 29:27.660 --> 29:30.540 Then, okay, so this is towards the end of my talk, right? 29:30.540 --> 29:34.900 So as I said, right, as of now, we actually just launched the second set of the challenge, right? 29:34.900 --> 29:36.080 Join the contacts right now. 29:36.080 --> 29:39.100 It's going to last until tomorrow night, midnight, right? 29:39.100 --> 29:40.840 So you still have plenty of time. 29:41.140 --> 29:44.380 This whole challenge, as I promised, is no code. 29:44.380 --> 29:45.820 You don't have to code up anything. 29:45.820 --> 29:54.200 The only thing you need is go to the website and put those address there and then start clicking, start exploring, right? 29:54.200 --> 29:59.580 But as you know, as an analyst, a researcher, you still have to have some expertise in that. 29:59.580 --> 30:06.160 But I mean, at the bare minimum, you don't need any technical skills to be able to enjoy this technology, right? 30:06.160 --> 30:10.260 And that's actually the main thesis when I talk to my team, right? 30:10.260 --> 30:16.200 This is one of the design principles I want the engineer, the designer to build, right? 30:16.200 --> 30:19.060 To build into our DNA of the product, right? 30:19.060 --> 30:24.340 And then, so we allocate over a thousand dollars worth of Bitcoin price, right? 30:24.340 --> 30:26.360 And so we're in the middle of it. 30:26.360 --> 30:29.740 So the first set of the challenge was the Twitter hack, right? 30:29.740 --> 30:34.740 So you can actually experience, you can be a detective yourself. 30:35.060 --> 30:37.020 Open the website, the contacts, right? 30:37.020 --> 30:38.660 And then, yeah, check it out. 30:38.660 --> 30:45.240 And then now we are launching a second set of the challenge, which is the ransomware that I just showed you. 30:49.300 --> 30:52.300 So that's the end of my talk. 30:52.300 --> 30:58.480 And yeah, so we got about 40 minutes and half an hour, 20 minutes. 30:58.480 --> 31:01.200 So Ajit, so we have a Q&A time. 31:09.150 --> 31:10.970 And by the way, this is the website, right? 31:10.970 --> 31:13.570 This is the blockchainviz.net contest. 31:16.950 --> 31:17.650 Okay, go ahead. 31:17.650 --> 31:18.590 Any questions? 31:51.070 --> 31:55.790 How many of you have tried the contest already? 31:55.790 --> 31:56.930 What do you guys think? 31:56.930 --> 31:58.210 Any thoughts? 31:58.210 --> 31:59.710 Any feedbacks 32:29.400 --> 32:29.980 ? 32:30.260 --> 32:32.040 Yeah, let's see. 32:35.980 --> 32:41.480 Oh, ah, I see. 32:42.680 --> 32:45.800 So there's a streaming on Twitch and also YouTube. 32:50.280 --> 32:51.360 All right, okay. 33:24.260 --> 33:25.640 Okay, yeah. 33:28.040 --> 33:29.420 Right, right. 33:29.420 --> 33:32.840 Yeah, actually I can see that there's already a few submissions, right? 33:32.840 --> 33:35.620 And then, yeah, so some of them already got it right, right? 33:35.620 --> 33:37.960 I think, yeah, the first set of the challenge, right? 33:37.960 --> 33:43.480 Yeah, so we do have a pretty intelligent cloud in the room here. 33:44.640 --> 33:45.740 But let's see. 33:45.740 --> 33:48.240 We still have, what, how many hours? 33:48.240 --> 33:50.640 We have one and a half days, right, ahead now. 33:50.640 --> 33:53.360 So we just launched the second set of the challenge, right? 33:53.360 --> 33:54.320 So check it out. 33:54.320 --> 33:56.180 And yeah, it's fun. 33:56.580 --> 33:58.460 And there's no any feedback and all that, right? 33:58.460 --> 34:06.180 So we're actually expecting a lot of, we actually saw a lot of traffic going to the website and we'll just upgrade the server and all that, right? 34:06.180 --> 34:08.780 So hopefully we can handle the traffic and all that. 34:08.780 --> 34:13.380 And yeah, so thanks a lot for participating in the contest. 34:13.380 --> 34:16.080 And let's see which one's going to be a winner . 34:23.030 --> 34:25.010 And it's fun. 34:25.250 --> 34:36.710 And it's fun that you can actually see those, you can become an investigator, and all this intelligence and all that are already publicly available in the public ledger, Bitcoin, which is great. 34:36.710 --> 34:40.170 We just need a tool to tap into it to make it more accessible. 35:05.440 --> 35:06.320 All right, cool. 35:06.320 --> 35:06.860 Thank you, Ajit. 35:06.860 --> 35:08.000 Thank you, everyone. 35:08.000 --> 35:09.000 Bye-bye. 35:13.420 --> 35:14.360 Thank you, Ajit. 35:14.360 --> 35:15.000 Thank you, everyone. 35:15.000 --> 35:15.660 Bye-bye.